snap-confine,browser-support: /dev/tty for snap-confine, misc browser-support for gnome-shell #3161

Merged
merged 6 commits into from Apr 10, 2017

Conversation

Projects
None yet
3 participants
Contributor

jdstrand commented Apr 10, 2017

  • snap-confine: allow access to /dev/tty sometimes needed for output (LP: #1681421)
  • interfaces/browser-support: misc accesses for gnome-shell on zesty

jdstrand added some commits Apr 10, 2017

zyga approved these changes Apr 10, 2017

LGTM

Contributor

jdstrand commented Apr 10, 2017

@zyga - made a refinement to one of the rules, can you recheck?

Looks good though we'll only see in time. How is this thing used?

Contributor

jdstrand commented Apr 10, 2017

@zyga - I guess you are talking about the shmfd access-- I don't know, it is in the chrome binary. I have a feeling that it is because of network printing that magically started working on zesty, but that is wild speculation. Limiting this new rule to owner makes it consistent with the other /dev/shm accesses and having it in the reserved 'allow-sandbox: true' section limits who can use it though.

mvo5 approved these changes Apr 10, 2017

@@ -109,7 +109,7 @@ func (s *BrowserSupportInterfaceSuite) TestConnectedPlugSnippetWithoutAttrib(c *
c.Assert(err, IsNil)
c.Assert(apparmorSpec.SecurityTags(), DeepEquals, []string{"snap.other.app2"})
snippet := apparmorSpec.SnippetForTag("snap.other.app2")
- c.Assert(string(snippet), testutil.Contains, `# Description: Can access various APIs needed by modern browers`)
+ c.Assert(string(snippet), testutil.Contains, `# Description: Can access various APIs needed by modern browsers`)
@zyga

zyga Apr 10, 2017

Contributor

❤️ thanks for finding that too :)

Contributor

jdstrand commented Apr 10, 2017

@mvo5 - ah thanks for the testsuite fix.

Collaborator

mvo5 commented Apr 10, 2017

@jdstrand Your very welcome, thanks for the real fix in there :)

jdstrand added some commits Apr 10, 2017

Contributor

jdstrand commented Apr 10, 2017

With the autopkgtests, there is one consistent unrelated failure: tests/main/interfaces-network-bind

Travis passes now so with two +1s, merging.

@jdstrand jdstrand merged commit 83da624 into snapcore:master Apr 10, 2017

1 of 6 checks passed

xenial-amd64 autopkgtest finished (failure)
Details
xenial-i386 autopkgtest finished (failure)
Details
xenial-ppc64el autopkgtest finished (failure)
Details
yakkety-amd64 autopkgtest finished (failure)
Details
zesty-amd64 autopkgtest finished (failure)
Details
continuous-integration/travis-ci/pr The Travis CI build passed
Details

@jdstrand jdstrand deleted the jdstrand:policy-updates-xxiii branch Apr 18, 2017

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment